Getting started

Your first call

1. Create an API key in the merchant portal under API Keys. You get a key id (nbm_live_…) and a secret. Keep the secret on your server: it signs your requests and never travels on the wire.
2. Sign every request with the secret, as Signing requests shows.
3. Call GET /me. It needs no scope and describes the calling key, so a 200 means your signing works. Every authentication failure is the same 401, whatever the cause.
4. Set your webhook in the merchant portal's webhook settings and verify its deliveries.

Before you go live

The API reference overview holds the rules every endpoint follows. Read these parts before you move money:

• Idempotency. Every POST that moves money needs an Idempotency-Key. On a timeout or a 5xx, retry with the same key — you never create a duplicate.
• Synchronous vs asynchronous. POST /payouts, /transfers and /fx/exchanges always answer 202. Branch on the body's status, never on the destination type.
• Rate limits. Limits apply per API key over a one-minute window. Prefer webhooks to polling.
• Errors. Branch on the problem's code, never on its text, and handle a code you do not know by its HTTP status. Errors lists every code and what to do about it.